open record looks like openat
John D. Ramsdell
ramsdell at mitre.org
Fri Jul 27 18:14:06 UTC 2007
ramsdell at mitre.org (John D. Ramsdell) writes:
> I carefully studied the output of my analysis program, and found one
> particularly odd line of output. I traced it back to an interesting
> audit event in the raw log (syscall 5 is the open system call):
I found the place in the source for the program that generates this
system call. It is a call to freopen on stderr.
John
More information about the Linux-audit
mailing list